← Back to Inly
Legal

Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how CONFUNDO LTD (“CONFUNDO”, “Inly”, “we”, “us” or “our”) collects, uses, discloses and otherwise processes personal information when you use the Inly mobile application, the website at myinly.com, and any related products and services (collectively, the “Service”).

CONFUNDO LTD is a company registered in Cyprus under registration number HE 497540, with its registered address at A.G. Leventi, 5, THE LEVENTIS GALLERY TOWER, 13th floor, Flat/Office 1301, 1097 Nicosia, Cyprus. For the purposes of applicable data protection law, CONFUNDO LTD is the controller of personal information processed through the Service, unless stated otherwise.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed through the Service. It does not apply to third-party websites, applications or services that may be linked from the Service and that operate under their own privacy policies.

Inly is an AI-powered thinking companion designed to support self-discovery, reflection and personal clarity. The terms governing use of the Service are set out in our Terms and Conditions.

2. Personal Information We Collect

Depending on how you use the Service, we may collect the following categories of personal information. We indicate at collection whether information is required to create an account, perform a contract or provide a feature; if you do not provide required information, we may be unable to provide that account or feature. Optional fields and consent-based optional processing are identified separately.

2.1 Account and profile information

  • Your name or display name, email address, login credentials or identifiers, country or region, and other information used to create and manage your account.
  • Preferences, settings and information you choose to add to your profile, and limited age-verification information where required.

2.2 Conversations and information you provide

  • Text messages, voice inputs, transcripts and other content you submit during conversations with Inly.
  • Onboarding answers, such as your age or age range, gender, goals and concerns, and information included in your Self Map, including information about your personality, values, beliefs, habits and interests.
  • Feedback, survey responses and other information you voluntarily provide.

Onboarding answers, conversations and Self Map information may reveal sensitive personal information, including health, religious or philosophical beliefs or other special categories of data. Providing an answer voluntarily or accepting our Terms is not, by itself, explicit consent to process sensitive information. Where required, we obtain specific, explicit consent for the relevant purpose before processing such information. Consent to optional analytics is separate from consent to provide a requested feature, and refusing optional analytics does not prevent access to the core Service.

2.3 Voice data

If you use voice features, your audio is processed to transcribe your speech and generate a response. Voice recordings are deleted from CONFUNDO’s active systems immediately after speech recognition and are not retained by CONFUNDO. We do not currently offer a feature that allows users to save voice recordings. Audio may be transmitted and processed temporarily by service providers as necessary to provide voice functionality. We may retain the resulting transcript as part of your conversation history, subject to your settings and the retention periods described below.

2.4 Device, technical and usage information

  • Device type, operating system, app version, browser type, language, time zone and general region inferred from an IP address.
  • IP address, device or advertising identifiers where permitted, log data, diagnostic information, crash reports and security events.
  • Information about how you use the Service, such as feature interactions, session events, funnels and retention events.

We do not send the content of conversations or transcripts to product analytics or crash-reporting tools.

2.5 Subscription and transaction information

We collect information required to manage your subscription, such as your selected plan, subscription status, renewal and cancellation status, transaction identifiers and limited payment-related details. Payments may be processed by app stores or third-party payment providers, including providers supporting cards, PayPal, Apple Pay or Google Pay. Those providers process payment credentials under their own privacy policies. We generally do not receive or store your complete card number.

2.6 Communications and support

When you contact us, we collect the content of your message, your contact details and information needed to respond to and resolve your request.

2.7 Information from third parties

We may receive information from app stores, authentication providers, payment providers, analytics and attribution partners, and other service providers. This may include account identifiers, subscription status, campaign or referral information, and fraud or security signals.

2.8 Website cookies and similar technologies

Our website uses cookies and similar technologies that may collect device identifiers, browsing and event information. Their purposes, consent requirements and available controls are described in Section 7 and our cookie notice or consent tool.

3. How We Use Personal Information

We may use personal information to:

  • Provide, operate and maintain the Service.
  • Create and manage accounts and authenticate users.
  • Process text and voice inputs and generate personalized AI responses.
  • Create, maintain and personalize the Self Map and other user-requested features.
  • Manage subscriptions, trials, renewals, cancellations and transactions.
  • Provide customer support and respond to requests.
  • Monitor reliability, diagnose errors, prevent fraud, abuse and security incidents, and protect users and the Service.
  • Conduct product analytics, including analysis of feature use, funnels and retention, without providing conversation content or transcripts to analytics tools.
  • Measure marketing campaigns and attribution, subject to consent and platform permissions where required.
  • Send service-related communications and, where permitted, marketing communications.
  • Comply with law, enforce our agreements and establish, exercise or defend legal claims.
  • Improve and develop the Service. We do not use conversation content to train our own general-purpose AI models. If our practices materially change, we will update this Privacy Policy and obtain consent where required.

If you are in the European Economic Area, the United Kingdom or another jurisdiction that requires a legal basis, we rely on one or more of the following:

  • Performance of a contract: to provide the Service you request, manage your account and subscription, and deliver support.
  • Consent: for optional analytics, tracking, advertising permissions and marketing communications where required. For special-category information, we also require a condition under applicable sensitive-data rules, such as specific, explicit consent where applicable; a general legitimate interest or acceptance of our Terms is not sufficient on its own.
  • Legitimate interests: to secure, maintain, analyze and improve the Service; prevent fraud and abuse; understand campaign effectiveness; and protect our rights and users, where those interests are not overridden by your rights.
  • Legal obligations: to comply with applicable law, regulatory requirements, tax and accounting rules, and lawful requests.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. AI and Voice Processing

Inly uses third-party AI and technical service providers, which may include Anthropic or similar providers, to process prompts, conversation content and related instructions and to generate responses. Information is shared with those providers only as reasonably necessary to provide and secure the relevant feature.

CONFUNDO’s handling of audio and transcripts is described in Section 2.3. Third-party providers may temporarily retain inputs and outputs under their applicable retention practices. Under our initial AI provider arrangements, provider copies are generally deleted within 30 days under the provider’s applicable retention cycle, except where longer retention is required to investigate or address suspected violations of usage policies, security incidents, legal obligations or lawful requests.

We do not permit service providers to use your personal conversation content for their own independent advertising purposes. Their processing is governed by contractual and technical safeguards and their applicable policies.

Inly does not make decisions producing legal or similarly significant effects about you solely through automated processing.

Safety-related processing

We process relevant user inputs and limited safety signals to apply safeguards against harmful responses, prevent abuse and provide crisis-resource referrals where appropriate. This may involve sensitive information, which is processed only for a necessary, defined purpose on the legal bases and sensitive-data conditions described in Section 4. Safety-related information is not used for advertising, and conversation content is not sent to product analytics. Any retained safety records are limited to what is necessary under Section 8. The product-safety rules and limitations are described in our Terms and Conditions.

6. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

  • AI and voice-processing providers that process inputs and generate responses.
  • Cloud hosting, database, security and infrastructure providers that help operate and protect the Service.
  • Payment providers and app stores that process transactions and manage subscriptions.
  • Analytics and crash-reporting providers that help us understand product use and technical performance. Conversation content and transcripts are not provided to these tools.
  • Marketing and attribution partners that help measure campaign performance, subject to applicable consent requirements and platform controls.
  • Professional advisers, such as lawyers, auditors, insurers and accountants, where reasonably necessary.
  • Authorities and other parties where disclosure is required by law or reasonably necessary to protect rights, safety, security or prevent fraud and abuse.
  • Parties to a corporate transaction, such as a merger, financing, acquisition, restructuring or sale of assets, subject to appropriate confidentiality and legal protections.

We may also disclose information at your direction or with your consent.

7. Analytics, Marketing, Advertising and Cookies

We use internal tools and, where selected and permitted, external providers for product analytics and crash reporting. Analytics may include feature-use, funnel, retention and technical events, and selected onboarding answers such as an age range, gender and non-sensitive goals. These records may be linked to a user ID and other identifiers needed for the stated purpose; they are not anonymous merely because a user ID is used. We limit fields and identifiers to what is necessary rather than transferring all available identifiers by default. Conversation content and transcripts are not sent to product analytics or crash-reporting tools.

We do not send raw free-text onboarding responses, health or other special-category answers, or dates of birth to standard third-party product-analytics tools. Any internal analysis of sensitive onboarding information requires a defined, necessary purpose, an appropriate legal basis and a separate condition for sensitive-data processing, including specific, explicit consent where required. Optional consent-based analytics can be refused or withdrawn through available privacy controls or by contacting us. External disclosures must also comply with the selected provider’s contractual restrictions, security requirements and applicable transfer safeguards. Onboarding answers are not sent to advertising platforms.

We may use attribution tools and advertising-platform software development kits to measure installations and conversions. On iOS, tracking that requires Apple’s App Tracking Transparency permission will occur only after permission is granted. You may change this permission in your device settings. We do not use personal information of users we know are under 18 for profiling-based targeted advertising, retargeting or advertising-audience creation.

On the website, we may use Meta Pixel and the Meta Conversions API to measure and optimize advertising based on events such as page views, registrations, checkout, purchases, subscriptions and cancellations. These tools may receive browser or device identifiers, campaign information, event IDs and timestamps, and limited subscription or transaction information such as plan, value and currency. Advanced Matching and sharing hashed email addresses or phone numbers are not enabled unless specifically disclosed at collection and supported by the required consent and safeguards; hashing does not make such information anonymous. In the EEA, the United Kingdom and other jurisdictions requiring prior consent, Meta Pixel and corresponding server-side Conversions API events are transmitted only after you consent to advertising technologies. We do not transmit conversation content, transcripts, audio recordings, Self Map information, onboarding answers or free-text cancellation reasons to Meta for advertising or marketing attribution. We do not display third-party advertisements inside the Inly application. We do not sell personal information as the term “sale” is defined under applicable privacy laws. Certain disclosures of device or campaign information to marketing partners may be considered “sharing” or targeted advertising under some privacy laws. Where such laws apply, you may opt out through available cookie controls, device or platform privacy settings, a legally recognized opt-out preference signal where required, or by contacting us.

Necessary website cookies support security, payment processing and fraud prevention. Non-essential website analytics and marketing technologies require your prior consent where applicable; you can change or withdraw that consent at any time through Cookie Settings. These website cookie controls are separate from mobile-app tracking controls. Apple’s App Tracking Transparency permission does not replace any additional consent required by applicable law. We may send promotional emails with your consent, and each includes a one-click unsubscribe option.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, meet legal obligations, resolve disputes and enforce agreements.

  • Cancellation or expiration of a subscription does not itself delete your account. We may retain account information and user content to provide continuing account functions or restore access after renewal, but only while needed for those purposes. An account with no active paid subscription is scheduled for deletion after 24 consecutive months without a login or meaningful interaction with the Service. We send notice to the account email at least 30 days before deletion, allowing you to reactivate the account, request a copy of eligible data or delete it earlier. This is our account-management rule, not a statutory retention period or a justification to retain every item for 24 months: we review necessity and delete or minimise sensitive content earlier when its purpose ends. The deletion and backup periods below apply once deletion is initiated.
  • You may delete available individual conversations or Self Map entries through the Service and may request deletion of your account and associated personal information at any time. Deleted content is removed from active systems within 30 days, subject to the exceptions and backup periods described below.
  • After you delete your account, we delete or de-identify associated personal information from active systems without undue delay and generally within 30 days. We instruct relevant service providers to delete the data and contractually require them to comply with applicable deletion obligations, unless a longer period is required or permitted by law.
  • Backup copies are maintained for disaster-recovery and security purposes. They are automatically rotated and overwritten, and deleted data may remain in isolated backup copies for up to 90 days after deletion. Access to backups is restricted, and backup data is not used for ordinary business purposes. If a backup is restored, applicable deletion requests are re-applied. The 90-day period provides an operational window to complete scheduled backup rotation and verify deletion across backup and disaster-recovery environments.
  • Copies processed by AI providers are generally deleted within 30 days under the provider’s applicable retention cycle, except where longer retention is required for usage-policy enforcement, security, legal obligations or lawful requests.
  • To administer eligibility for free trials, introductory offers and discounts and to prevent fraud or abuse, we may retain limited information needed to determine whether a user has previously used or is eligible for an offer for as long as reasonably necessary for those purposes.
  • Analytics data, technical logs, support, payment, subscription, fraud-prevention and privacy-choice records have purpose-specific retention periods based on necessity, sensitivity, legal requirements and applicable claim periods. Legally required records may remain after account deletion; this does not justify retaining conversation history or sensitive onboarding answers for the same period. Where California automatic-renewal law applies, verification of affirmative consent to automatic renewal is retained for at least three years, or one year after termination of the contract, whichever is longer. We retain only the limited evidence needed for this obligation.

We may retain aggregated or de-identified information that cannot reasonably be linked to you.

9. Security

We use reasonable administrative, technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss or destruction. No system or method of transmission is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us if you suspect unauthorized access to your account.

10. Your Choices and Rights

Depending on your location and subject to applicable exceptions, you may have the right to:

  • Access personal information we hold about you and receive a copy.
  • Correct inaccurate or incomplete personal information.
  • Delete personal information.
  • Restrict or object to certain processing.
  • Withdraw consent where processing is based on consent.
  • Receive certain information in a portable format.
  • Opt out of marketing communications, targeted advertising, or certain disclosures considered “sharing” under applicable law.
  • Appeal our decision concerning a privacy request, where applicable.
  • Lodge a complaint with a competent data protection or supervisory authority.

Use “Delete account” in the application or your website account to request deletion of your account and associated personal information; support@myinly.com is an additional way to obtain assistance, not a mandatory step. Ending a subscription or withdrawing from a contract does not itself erase account data; retention and deletion are governed by Section 8. The separate rules for subscription cancellation and withdrawal are set out in our Terms. You can unsubscribe from marketing emails using the link in the message; necessary service communications may continue.

To exercise a privacy right, contact us at support@myinly.com or use the available account controls. We may request only information reasonably necessary to verify your identity. Where permitted by law, an authorized agent may submit a request on your behalf. We respond within the applicable statutory deadlines and will not discriminate against you for exercising applicable privacy rights.

European Economic Area and United Kingdom

If you are in the EEA or United Kingdom, you may exercise the rights described above and lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement. We normally respond without undue delay and within one month; where the law permits an extension because of the complexity or number of requests, we inform you within that first month of the extension and its reasons. You may object at any time to processing for direct marketing, including related profiling.

United States state privacy rights

Residents of California and certain other U.S. states may have rights to know, access, correct or delete personal information; obtain a portable copy; opt out of targeted advertising, sale or sharing; limit certain uses of sensitive personal information; and appeal a refusal to act on a request. These rights vary by state and may be subject to legal exceptions.

We do not sell personal information as the term “sale” is defined under applicable U.S. state privacy laws. We use sensitive personal information only as reasonably necessary to provide user-requested features, secure the Service and for other purposes permitted by law; we do not use it for targeted advertising. We may disclose identifiers and device or campaign information to attribution or advertising partners for measurement where permitted, which may be treated as sharing or targeted advertising under some laws. Requests to opt out or limit eligible processing may be submitted through available website controls, device settings or by emailing support@myinly.com.

11. International Data Transfers

CONFUNDO is established in Cyprus, and our service providers may process information in the United States and other countries that may have different data protection laws from your country. Where required, we use appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms. You may contact us for details of the applicable transfer safeguards, including how to obtain a copy where available, subject to appropriate redactions.

12. Age Restriction

The minimum age for the Service is 18. A higher minimum age or restriction applies where required by applicable law or marketplace rules. The Service is not intended for users under 18. We use proportionate age-assurance measures and collect only the verification information reasonably needed; age-verification information is not used for advertising. We do not knowingly permit users under 18. If we learn that an ineligible user has supplied personal information, we take reasonable steps to restrict access and delete it, subject to applicable legal obligations. Concerns may be reported to support@myinly.com.

Eligibility and product-safety requirements are set out in our Terms and Conditions.

13. Third-Party Services

Independent third-party services linked from the Service may process information under their own privacy notices. We encourage you to review those notices. This does not exclude CONFUNDO’s responsibility for its own processing, its selection and oversight of processors acting on its behalf, or any responsibility that cannot lawfully be excluded.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our practices or applicable law. We post the updated version and revise the “Last updated” date. Before using personal information for a new purpose, we provide the required information and obtain fresh consent where required. Material changes are notified as required by law; continuing to use the Service does not replace any consent that must be separately obtained.

15. Contact Us

If you have questions, concerns or requests concerning this Privacy Policy or our privacy practices, contact:

CONFUNDO LTD
Registration number: HE 497540
A.G. Leventi, 5
THE LEVENTIS GALLERY TOWER
13th floor, Flat/Office 1301
1097 Nicosia, Cyprus
Email: support@myinly.com
Website: myinly.com